Files
@ 8018788c81c4
Branch filter:
Location: majic-ansible-roles/roles/common/molecule/default/prepare.yml
8018788c81c4
3.4 KiB
text/x-yaml
MAR-189: Rework fix for legacy iptables and ferm:
- Unfortunately, using diversions with iptables legacy binaries does
not work correctly because the iptables package will try to run
update-alternatives on install/upgrade, and error out because the
files are not available in the original locations.
- Divert the ferm binary instead, and roll-out a custom patched
version of it instead.
- Use a custom script to drop the legacy iptables (for both IPv4 and
IPv6).
- Update the tests accordingly.
- Unfortunately, using diversions with iptables legacy binaries does
not work correctly because the iptables package will try to run
update-alternatives on install/upgrade, and error out because the
files are not available in the original locations.
- Divert the ferm binary instead, and roll-out a custom patched
version of it instead.
- Use a custom script to drop the legacy iptables (for both IPv4 and
IPv6).
- Update the tests accordingly.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 | ---
- name: Set-up fixtures
hosts: localhost
connection: local
gather_facts: false
tasks:
- name: Initialise CA hierarchy
command: "gimmecert init --ca-hierarchy-depth 2"
args:
creates: ".gimmecert/ca/level1.cert.pem"
chdir: "tests/data/"
- name: Set-up link to generated X.509 material
file:
src: ".gimmecert"
dest: "tests/data/x509"
state: link
- name: Prepare
hosts: all
gather_facts: false
tasks:
- name: Install python for Ansible
raw: test -e /usr/bin/python3 || (apt -y update && apt install -y python3-minimal)
become: true
changed_when: false
- hosts: all
become: true
tasks:
- name: Update all caches to avoid errors due to missing remote archives
apt:
update_cache: true
changed_when: false
- name: Install net-tools for running Testinfra host.socket tests
apt:
name: net-tools
state: present
- hosts: helper
become: true
tasks:
- name: Install apt-cacher-ng
apt:
name: apt-cacher-ng
state: present
- hosts: client
become: true
tasks:
- name: Install tool for testing TCP connectivity
apt:
name: hping3
state: present
- name: Set-up /etc/hosts with entries for all servers
lineinfile:
path: /etc/hosts
regexp: "^{{ item.key }}"
line: "{{ item.key }} {{ item.value }}"
owner: root
group: root
mode: 0644
state: present
with_dict:
192.168.56.21: parameters-mandatory-buster
192.168.56.22: parameters-optional-buster
192.168.56.31: parameters-mandatory-bullseye
192.168.56.32: parameters-optional-bullseye
- hosts: parameters-mandatory,parameters-optional
become: true
tasks:
- name: Install tool for testing TCP connectivity
apt:
name: hping3
state: present
- name: Set-up /etc/hosts with entries for all servers
lineinfile:
path: /etc/hosts
regexp: "^{{ item.key }}"
line: "{{ item.key }} {{ item.value }}"
owner: root
group: root
mode: 0644
state: present
with_dict:
192.168.56.3: client1
192.168.56.4: client2
- name: Load legacy iptables to test their removal
modprobe:
name: "{{ item }}"
state: present
with_items:
- iptable_filter
- iptable_nat
- iptable_mangle
- iptable_security
- iptable_raw
- ip6table_filter
- ip6table_nat
- ip6table_mangle
- ip6table_security
- ip6table_raw
- name: Create some custom legacy iptables chains for testing their removal (max chain name length is 29)
command: "iptables-legacy -t '{{ item }}' -N '{{ (ansible_date_time.iso8601_micro | to_uuid)[:28] }}'"
with_items:
- filter
- nat
- mangle
- security
- raw
- name: Create some custom legacy ip6tables chains for testing their removal (max chain name length is 29)
command: "ip6tables-legacy -t '{{ item }}' -N '{{ (ansible_date_time.iso8601_micro | to_uuid)[:28] }}'"
with_items:
- filter
- nat
- mangle
- security
- raw
- hosts: parameters-mandatory,parameters-optional
become: true
tasks:
- name: Remove the ss utility (see https://github.com/philpep/testinfra/pull/320)
file:
path: "/bin/ss"
state: absent
|